tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	950fc28887	ipn, paths, cmd/tailscaled: remove LegacyConfigPath, relaynode migration It is time. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Maisem Ali	db13b2d0c8	cmd/tailscale, ipn/localapi: add "tailscale bugreport" subcommand Adding a subcommand which prints and logs a log marker. This should help diagnose any issues that users face. Fixes #1466 Signed-off-by: Maisem Ali <maisem@tailscale.com>	4 years ago
Brad Fitzpatrick	27c4dd9a97	Revert "cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend" This reverts commit `2bc518dcb2`. @namansood didn't end up needing it in his `770aa71ffb`.	4 years ago
Brad Fitzpatrick	2bc518dcb2	cmd/tailscaled, ipn/{ipnlocal,ipnserver}: let netstack get access to LocalBackend Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	43b30e463c	ipn/ipnserver: refactor permissions checks a bit, document more, fix Windows Windows was only running the localapi on the debug port which was a stopgap at the time while doing peercreds work. Removed that, and wired it up correctly, with some more docs. More clean-up to do after 1.6, moving the localhost TCP auth code into the peercreds package. But that's too much for now, so the docs will have to suffice, even if it's at a bit of an awkward stage with the newly-renamed "NotWindows" field, which still isn't named well, but it's better than its old name of "Unknown" which hasn't been accurate since unix sock peercreds work anyway. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1ca3e739f7	ipn/ipnserver: set PermitWrite on localapi handler The TODO was easy now with peerCreds and the isReadonlyConn func. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	15b6969a95	ipn/ipnserver: grant client r/w access if peer uid matches tailscaled Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	be779b3587	safesocket, ipn/ipnserver: unify peercred info, fix bug on FreeBSD etc FreeBSD wasn't able to run "tailscale up" since the recent peercred refactoring. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	f11952ad7f	ipn/ipnserver: fix Windows connection auth regression Regression from code movement in `d3efe8caf6` Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	7038c09bc9	ipn/ipnserver: on darwin, let users who are admins use CLI without sudo Tangentially related to #987, #177, #594, #925, #505 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	d3efe8caf6	safesocket, ipn/ipnserver: look up peer creds on Darwin And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	fdac0387a7	ipn/ipnserver, ipn/ipnlocal: move whois handler to new localapi package	4 years ago
Brad Fitzpatrick	d76334d2f0	ipn: split LocalBackend off into new ipn/ipnlocal package And move a couple other types down into leafier packages. Now cmd/tailscale doesn't bring in netlink, magicsock, wgengine, etc. Fixes #1181 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	006a224f50	ipn/ipnserver, cmd/hello: do whois over unix socket, not debug http Start of a local HTTP API. Not a stable interface yet.	4 years ago
Brad Fitzpatrick	c611d8480b	cmd/tailscaled: add whois/identd-ish debug handler	4 years ago
Brad Fitzpatrick	4d3c09ced4	ipn/ipnserver: on Windows in unattended mode, wait for Engine forever Updates #1187	4 years ago
Brad Fitzpatrick	5611f290eb	ipn, ipnserver: only require sudo on Linux for mutable CLI actions This partially reverts `d6e9fb1df0`, which modified the permissions on the tailscaled Unix socket and thus required "sudo tailscale" even for "tailscale status". Instead, open the permissions back up (on Linux only) but have the server look at the peer creds and only permit read-only actions unless you're root. In the future we'll also have a group that can do mutable actions. On OpenBSD and FreeBSD, the permissions on the socket remain locked down to 0600 from `d6e9fb1df0`. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	053a1d1340	all: annotate log verbosity levels on most egregiously spammy log prints Fixes #924 Fixes #282 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Christine Dodrill	7ea809897d	ipn/ipnserver: enable systemd-notify support Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>	4 years ago
Brad Fitzpatrick	acade77c86	ipn/ipnserver: add knob to disable babysitter	4 years ago
Brad Fitzpatrick	07b6ffd55c	ipn: only use Prefs, not computed stateKey, to determine server mode When the service was running without a client (e.g. after a reboot) and then the owner logs in and the GUI attaches, the computed state key changed to "" (driven by frontend prefs), and then it was falling out of server mode, despite the GUI-provided prefs still saying it wanted server mode. Also add some logging. And remove a scary "Access denied" from a user-visible error, making the two possible already-in-use error messages consistent with each other.	4 years ago
Brad Fitzpatrick	20a357b386	ipn, ipn/ipnserver: add IPN state for server in use, handle explicitly On Windows, we were previously treating a server used by different users as a fatal error, which meant the second user (upon starting Tailscale, explicitly or via Start Up programs) got an invasive error message dialog. Instead, give it its own IPN state and change the Notify.ErrMessage to be details in that state. Then the Windows GUI can be less aggresive about that happening. Also, * wait to close the IPN connection until the server ownership state changes so the GUI doesn't need to repeatedly reconnect to discover changes. * fix a bug discovered during testing: on system reboot, the ipnserver's serverModeUser was getting cleared while the state transitioned from Unknown to Running. Instead, track 'inServerMode' explicitly and remove the old accessor method which was error prone. * fix a rare bug where the client could start up and set the server mode prefs in its Start call and we wouldn't persist that to the StateStore storage's prefs start key. (Previously it was only via a prefs toggle at runtime)	4 years ago
Brad Fitzpatrick	f3aa08de76	ipn/ipnserver: remove "Server mode" from a user-visible error message That's an internal nickname.	4 years ago
Brad Fitzpatrick	ff7ddd9d20	ipn/ipnserver: move Windows local disk logging up to the parent process To capture panics, log.Printf writes to os.Stderr, etc. Fixes #726	4 years ago
Brad Fitzpatrick	c64718e9a0	ipn/ipnserver: work around os/user.LookupId failure on Windows If we can't find the mapping from SID ("user ID") -> username, don't treat that as a fatal. Apparently that happens in the wild for Reasons. Ignore it for now. It's just a nice-to-have for error messages in the rare multi-user case. Updates #869 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
David Anderson	54e6c3a290	version: use OSS repo's version when building. When building with redo, also include the git commit hash from the proprietary repo, so that we have a precise commit that identifies all build info (including Go toolchain version). Add a top-level build script demonstrating to downstream distros how to burn the right information into builds. Adjust `tailscale version` to print commit hashes when available. Fixes #841. Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
Brad Fitzpatrick	515866d7c6	ipn, ipnserver, cmd/tailscale: add "server mode" support on Windows This partially (but not yet fully) migrates Windows to tailscaled's StateStore storage system. This adds a new bool Pref, ForceDaemon, defined as: // ForceDaemon specifies whether a platform that normally // operates in "client mode" (that is, requires an active user // logged in with the GUI app running) should keep running after the // GUI ends and/or the user logs out. // // The only current applicable platform is Windows. This // forced Windows to go into "server mode" where Tailscale is // running even with no users logged in. This might also be // used for macOS in the future. This setting has no effect // for Linux/etc, which always operate in daemon mode. Then, when ForceDaemon becomes true, we now write use the StateStore to track which user started it in server mode, and store their prefs under that key. The ipnserver validates the connections/identities and informs that LocalBackend which userid is currently in charge. The GUI can then enable/disable server mode at runtime, without using the CLI. But the "tailscale up" CLI was also fixed, so Windows users can use authkeys or ACL tags, etc. Updates #275	4 years ago
Brad Fitzpatrick	638127530b	ipn/ipnserver: prevent use by multiple Windows users, add HTML status page It was previously possible for two different Windows users to connect to the IPN server at once, but it didn't really work. They mostly stepped on each other's toes and caused chaos. Now only one can control it, but it can be active for everybody else. Necessary dependency step for Windows server/headless mode (#275) While here, finish wiring up the HTTP status page on Windows, now that all the dependent pieces are available.	4 years ago
Brad Fitzpatrick	4f71319f7c	ipn/ipnserver: make ipnserver also be an HTTP server for localhost clients For now it just says hello to show auth works. More later.	4 years ago
Brad Fitzpatrick	dd97111d06	backoff: update to Go style, document a bit, make 30s explicit Also, bit of behavior change: on non-nil err but expired context, don't reset the consecutive failure count. I don't think the old behavior was intentional. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	cbf71d5eba	ipn/ipnserver: fix bug in earlier commit where conn can be stranded If a connection causes getEngine to transition from broken to fixed, that connection was getting lost.	4 years ago
Brad Fitzpatrick	9ff5b380cb	ipn/ipnserver: staticcheck is not wrong shamecube.gif	4 years ago
Brad Fitzpatrick	4aba86cc03	ipn/ipnserver: make Engine argument a func that tries again for each connection So a backend in server-an-error state (as used by Windows) can try to create a new Engine again each time somebody re-connects, relaunching the GUI app. (The proper fix is actually fixing Windows issues, but this makes things better in the short term) Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Brad Fitzpatrick	1f923124bf	ipn/ipnserver: support simultaneous connections Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	4 years ago
Dmytro Shynkevych	61abab999e	cmd/tailscaled: graceful shutdown (#534 ) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>	4 years ago
Brad Fitzpatrick	3984f9be2f	ipn, ipn/ipnserver: add support for serving in error-message-only mode So Windows service failures can be propagated to the Windows UI client.	4 years ago
David Anderson	9cd4e65191	smallzstd: new package that constructs zstd small encoders/decoders. It's just a config wrapper that passes "use less memory at the expense of compression" parameters by default, so that we don't accidentally construct resource-hungry (de)compressors. Also includes a benchmark that measures the memory cost of the small variants vs. the stock variants. The savings are significant on both compressors (~8x less memory) and decompressors (~1.4x less, not including the savings from the significantly smaller window on the compression side - with those savings included it's more like ~140x smaller). BenchmarkSmallEncoder-8 56174 19354 ns/op 31 B/op 0 allocs/op BenchmarkSmallEncoderWithBuild-8 2900 382940 ns/op 1746547 B/op 36 allocs/op BenchmarkStockEncoder-8 48921 25761 ns/op 286 B/op 0 allocs/op BenchmarkStockEncoderWithBuild-8 426 2630241 ns/op 13843842 B/op 124 allocs/op BenchmarkSmallDecoder-8 123814 9344 ns/op 0 B/op 0 allocs/op BenchmarkSmallDecoderWithBuild-8 41547 27455 ns/op 27694 B/op 31 allocs/op BenchmarkStockDecoder-8 129832 9417 ns/op 1 B/op 0 allocs/op BenchmarkStockDecoderWithBuild-8 25561 51751 ns/op 39607 B/op 92 allocs/op Signed-off-by: David Anderson <danderson@tailscale.com>	4 years ago
David Anderson	c71754eba2	ipn/ipnserver: revert decoder memory limit. The zstd library treats that limit as a hard cap on decompressed size, in the mode we're using it, rather than a window size. Signed-off-by: David Anderson <danderson@tailscale.com>	5 years ago
Avery Pennarun	db051fb013	ipnserver and logpolicy: configure zstd with low-memory settings. The compressed blobs we send back and forth are small and infrequent, which doesn't justify the 8MB * GOMAXPROCS memory that was being allocated. This was the overwhelming majority of memory use in tailscaled. On my system it goes from ~100M RSS to ~15M RSS (which is still suspiciously high, but we can worry about that more later). Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Avery Pennarun	08acb502e5	Add tstest.PanicOnLog(), and fix various problems detected by this. If a test calls log.Printf, 'go test' horrifyingly rearranges the output to no longer be in chronological order, which makes debugging virtually impossible. Let's stop that from happening by making log.Printf panic if called from any module, no matter how deep, during tests. This required us to change the default error handler in at least one http.Server, as well as plumbing a bunch of logf functions around, especially in magicsock and wgengine, but also in logtail and backoff. To add insult to injury, 'go test' also rearranges the output when a parent test has multiple sub-tests (all the sub-test's t.Logf is always printed after all the parent tests t.Logf), so we need to screw around with a special Logf that can point at the "current" t (current_t.Logf) in some places. Probably our entire way of using subtests is wrong, since 'go test' would probably like to run them all in parallel if you called t.Parallel(), but it definitely can't because the're all manipulating the shared state created by the parent test. They should probably all be separate toplevel tests instead, with common setup/teardown logic. But that's a job for another time. Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>	5 years ago
Brad Fitzpatrick	45f2b53aca	all: remove unnecessary trailing newlines in format patterns for consistency And document on logger.Logf that it's unnecessary.	5 years ago
Brad Fitzpatrick	a4ef345737	cmd/tailscale: add status subcommand Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	322499473e	cmd/tailscaled, wgengine, ipn: add /debug/ipn handler with world state Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Avery Pennarun	b4897e7de8	controlclient/netmap: write our own b.ConciseDiffFrom(a) function. This removes the need for go-cmp, which is extremely bloaty so we had to leave it out of iOS. As a result, we had also left it out of macOS, and so we didn't print netmap diffs at all on darwin-based platforms. Oops. As a bonus, the output format of the new function is way better. Minor oddity: because I used the dumbest possible diff algorithm, the sort order is a bit dumb. We print all "removed" lines and then print all "added" lines, rather than doing the usual diff-like thing of interspersing them. This probably doesn't matter (maybe it's an improvement).	5 years ago
Brad Fitzpatrick	4cf5ac3060	ipn/ipnserver: remove unnecessary closure parameter	5 years ago
Brad Fitzpatrick	06092a3af3	ipn/ipnserver: document potential race, start on test for it	5 years ago
Brad Fitzpatrick	3988ddc85d	types/logger: add WithPrefix, use it in two places Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
Brad Fitzpatrick	367ffde21a	ipn: misc cleanup Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	5 years ago
David Anderson	0c55777fed	ipn: temporary support for loading legacy relaynode configs. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago
David Anderson	cf1e386cbd	ipn: move Options.ServerURL into Prefs. We can't rely on a frontend to provide a control server URL, so this naturally belongs in server-persisted state. Signed-off-by: David Anderson <dave@natulte.net>	5 years ago

1 2

57 Commits (eb6115e29535ecda48773eea04c87d2eb94d09e4)